Cardano's Splash Exploit is Patched, But 2.4M ADA Still Missing

What Happened

Splash Protocol has patched the smart contract vulnerability behind the September 13 exploit that drained its Cardano-based $ADA/OADA StableSwap pool. The fix closes the documented attack path, but it cannot recover the funds that are already gone.

According to Splash's incident report, one actor used two transactions to remove 2,434,648 ADA and 1,988,222 OADA. After subtracting the attacker's 9,870 ADA deposit, but before network fees, the net ADA drain was 2,424,778.

The pool's validator calculated a "tradable" reserve by subtracting accrued protocol fees from its real balances. According to Splash, it did not require that reserve to remain positive, bounded fee changes only from below, and did not enforce the direction of a swap. Those missing checks allowed the validator to accept a transaction after the tradable ADA reserve had turned negative.

Either fix would close the documented exploit path, but neither would return the ADA that had already left the pool. Immediately after the drain, the pool held just 10 ADA and about 1.44 million OADA, while its tradable ADA reserve was negative and its LP token balance was unchanged.

The Liquidity Problem That Remains

A usable relaunch would require more than corrected validator logic. It would need replenished ADA liquidity or a protocol redemption mechanism, along with a way to address the OADA inventory in the thin secondary market.

Optim Finance said on September 13 that its protocol was paused, remaining liquidity had been removed, and OADA-to-ADA swaps were unavailable. In a September 15 update, it said it was indexing the chain and compiling a full accounting of impacted addresses and assets while working toward a resolution. That update did not announce restored liquidity, redemption, or operations.

The balance-sheet damage matters because Splash's September 13 snapshot said OADA had no protocol-level redemption. Other OADA venues in the report were close to empty at that time, with the listed pools holding only single- or double-digit ADA balances.

DefiLlama data showed Splash Protocol total value locked (TVL) near $3.3 million on Cardano, with a one-day decline of roughly 27 percent in one snapshot in the wake of the incident. Cardano DeFi as a whole was tracking around $55 million in TVL. Until new liquidity is injected or a formal redemption route is announced, OADA holders remain without a meaningful exit.

Sources:
CryptoSlate: Cardano's Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped
Crypto Times: Optim Finance Pauses OADA After Splash Pool Exploit Drains Cardano Liquidity